Re: spamd does not start

2014-10-09 Thread Martin Gregorie
On Thu, 2014-10-09 at 11:50 +0700, Olivier Nicole wrote:
 Hi,
 
/usr/local/bin/sa-update  /usr/local/bin/sa-compile  
  /usr/local/etc/rc.d/sa-spamd restart
  
  the  only time spamd would restart is if sa-update AND sa-compile were
  successfully completed, correct?
 
Yes, that's correct.

 Sorry for jumping in the conversation... I have solved that issue by
 calling sa-update from a script (perl) and I do a spamassassin -lint
 before ever trying to restart spamd (or amavisd in my case), so I am
 sure that I will only restart on something clean.
 
 That way, I can also update some rules that are not on sa-update.
 
I do something similar on my SA rules development system (I also have SA
installed on this laptop but it is normally not running, which has the
side effect of disabling the standard Fedora sa-update cron job because
this won't run sa-update if it can't find the spamd daemon). My more
complex equivalent is a bash script rather than Perl which starts and
stops SA after a successful update in order to check that all is in
order. This is it. I think the use of the case...esac construct makes it
easier to read:

===
#!/bin/bash
#
# Update the Spamassassin rules
#
sau=/usr/bin/sa-update

if [ -x $sau ]
then
$sau
err=$?
case $err in
0)  echo Spamassassin rules update completed.;
service spamassassin restart;
service spamassassin stop;
echo Spamassassin restarted and then stopped. ;;

1)  echo No Spamassassin rule updates available.;;

2)  echo Spamassassin rules updates available;
echo Site pre files lint check failed.;
echo Fix the files and try again.;;

*)  echo Spamassassin rules update failed: error=$err
esac
else
echo Error: $sau does not exist
exit 0
fi
===

 And in any case, send myself an email if something went wrong.
 
I get the mail 'for free' because I run logwatch, which picks up
anything logged by crond (i.e. anything sent to stdout and stderr by a
cron job) and mails it to root and, of course, I set up the mail aliases
so mail sent to root is redirected to my usual login.
  
 Being executed only once a day, the extra load of a Perl script is
 neglectible.
 
Agreed.


Martin





Re: spamd does not start

2014-10-09 Thread Olivier Nicole
Martin, 
 I do something similar on my SA rules development system (I also have SA
 installed on this laptop but it is normally not running, which has the
 side effect of disabling the standard Fedora sa-update cron job because
 this won't run sa-update if it can't find the spamd daemon). My more
 complex equivalent is a bash script rather than Perl which starts and
 stops SA after a successful update in order to check that all is in
 order. This is it. I think the use of the case...esac construct makes it
 easier to read:

But you don't do a -lint before restarting SA: if an update was to break
SA (like a big Perl syntax error in a rule, or you are working on a
plugin on your production system, you feel safe because as long as you
don't restart spamd, any bad modification you make will not break SA),
you have stoppped the one that is currently working (and that could keep
working despite the update) amd you find yourself trying to restart a
broken version of SA.

Best regards,

Olivier

 ===
 #!/bin/bash
 #
 # Update the Spamassassin rules
 #
 sau=/usr/bin/sa-update

 if [ -x $sau ]
 then
 $sau
 err=$?
 case $err in
 0)  echo Spamassassin rules update completed.;
 service spamassassin restart;
 service spamassassin stop;
 echo Spamassassin restarted and then stopped. ;;

 1)  echo No Spamassassin rule updates available.;;

 2)  echo Spamassassin rules updates available;
 echo Site pre files lint check failed.;
 echo Fix the files and try again.;;

 *)  echo Spamassassin rules update failed: error=$err
 esac
 else
 echo Error: $sau does not exist
 exit 0
 fi
 ===

 And in any case, send myself an email if something went wrong.
 
 I get the mail 'for free' because I run logwatch, which picks up
 anything logged by crond (i.e. anything sent to stdout and stderr by a
 cron job) and mails it to root and, of course, I set up the mail aliases
 so mail sent to root is redirected to my usual login.
   
 Being executed only once a day, the extra load of a Perl script is
 neglectible.
 
 Agreed.


 Martin





-- 


Re: spamd does not start

2014-10-09 Thread Martin Gregorie
On Thu, 2014-10-09 at 18:08 +0700, Olivier Nicole wrote:
 But you don't do a -lint before restarting SA: if an update was to break
 SA (like a big Perl syntax error in a rule, or you are working on a
 plugin on your production system, you feel safe because as long as you
 don't restart spamd, any bad modification you make will not break SA),
 you have stoppped the one that is currently working (and that could keep
 working despite the update) amd you find yourself trying to restart a
 broken version of SA.
 
This isn't my production system: that is updated daily by the standard
RedHat cron job. This copy of SA is only run when I'm writing/modifying
rules or (much less often) working in a plugin. It is stopped 99% of the
time. It goes without saying that I use -lint during rule or plugin
development.

I'm certain that there is a lot in this script you could criticise, but
it does exactly what I need: pulls down any updated rules on a weekly
basis and finds any obvious errors in the download by starting and
stopping spamd and reporting its operation via logwatch. I posted it to
show anybody who doesn't use bash case statements just how readable they
can make a shell script.

Martin

 





Re: Score Ignored

2014-10-09 Thread Bowie Bailey

On 10/8/2014 5:03 PM, Axb wrote:

On 10/08/2014 10:48 PM, Robert A. Ober wrote:

On 9/22/14 4:20 PM, RW wrote:

On Mon, 22 Sep 2014 15:11:44 -0500
Robert A. Ober wrote:



*Yes,  my test messages and SPAM hit the rules but ignore the score.*

What score does it have?

Could it be that the score got set after spamd was restarted?

__

What is the easiest way to know what score is applied per rule? Neither
the server log nor the header breaks it down.

I think the SA's docs show you how

http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.txt


TEMPLATE TAGS

_REPORT_  terse report of tests hit (for header reports)

put this in you local.cf :

add_header all Report _REPORT_

iirc, this will add a nice  X-Spam-Report:  header with a list of rules
AND scores.


This should already be the default for messages marked as spam.  The 
line above will add the report to ham messages as well.


--
Bowie


Re: Score Ignored

2014-10-09 Thread Axb

On 10/09/2014 03:30 PM, Bowie Bailey wrote:

On 10/8/2014 5:03 PM, Axb wrote:

On 10/08/2014 10:48 PM, Robert A. Ober wrote:

On 9/22/14 4:20 PM, RW wrote:

On Mon, 22 Sep 2014 15:11:44 -0500
Robert A. Ober wrote:



*Yes,  my test messages and SPAM hit the rules but ignore the score.*

What score does it have?

Could it be that the score got set after spamd was restarted?

__

What is the easiest way to know what score is applied per rule? Neither
the server log nor the header breaks it down.

I think the SA's docs show you how

http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.txt


TEMPLATE TAGS

_REPORT_  terse report of tests hit (for header reports)

put this in you local.cf :

add_header all Report _REPORT_

iirc, this will add a nice  X-Spam-Report:  header with a list of rules
AND scores.


This should already be the default for messages marked as spam.  The
line above will add the report to ham messages as well.


I don't see that in the default templates in 10_default_prefs.cf
am I missing something? blind?

if you use report_safe 0 does it really add the full reports?

It's been years since I've used an aboslutely default SA.



Re: Score Ignored

2014-10-09 Thread Bowie Bailey

On 10/9/2014 9:40 AM, Axb wrote:

On 10/09/2014 03:30 PM, Bowie Bailey wrote:

On 10/8/2014 5:03 PM, Axb wrote:

On 10/08/2014 10:48 PM, Robert A. Ober wrote:

On 9/22/14 4:20 PM, RW wrote:

On Mon, 22 Sep 2014 15:11:44 -0500
Robert A. Ober wrote:



*Yes,  my test messages and SPAM hit the rules but ignore the score.*

What score does it have?

Could it be that the score got set after spamd was restarted?

__

What is the easiest way to know what score is applied per rule? Neither
the server log nor the header breaks it down.

I think the SA's docs show you how

http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.txt


TEMPLATE TAGS

_REPORT_  terse report of tests hit (for header reports)

put this in you local.cf :

add_header all Report _REPORT_

iirc, this will add a nice  X-Spam-Report:  header with a list of rules
AND scores.

This should already be the default for messages marked as spam.  The
line above will add the report to ham messages as well.

I don't see that in the default templates in 10_default_prefs.cf
am I missing something? blind?

if you use report_safe 0 does it really add the full reports?

It's been years since I've used an aboslutely default SA.


I don't know where you would find it in the templates.  I just know that 
by default, SA adds an X-Spam-Report header to spam.  It looks like this 
(blacklisted ip addresses removed to avoid spam filters):


X-Spam-Report:
*  0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
*  [xx.xx.xx.xx listed in dnsbl.sorbs.net]
* -1.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
*  [xx.xx.xx.xx listed in wl.mailspike.net]
*  2.0 BAYES_80 BODY: Bayes spam probability is 80 to 95%
*  [score: 0.8911]
*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
*  valid
* -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
*  0.0 TVD_SPACE_RATIO No description available.
*  0.8 BODY_URI_ONLY Message body is only a URI in one line of text 
or for

*  an image
*  2.8 TVD_SPACE_RATIO_MINFP No description available.
*  0.2 AWL AWL: From: address is in the auto white-list

Ah!  Apparently, this is only done with a setting of report_safe 0.

From the report_safe section of the Mail::SpamAssassin::Conf man page:
If this option is set to 0, incoming spam is only modified by 
adding some X-Spam- headers
and no changes will be made to the body.  In addition, a header 
named X-Spam-Report will be

added to spam.

The line:
add_header all Report _REPORT_
will add this header to all messages regardless of spam status.

--
Bowie


RE: spamassassin working very poorly

2014-10-09 Thread Nick
Wanted to send an update. After successfully getting Bayes to read through 
hand-sorted SPAM and HAM, as well as getting URIBL working, it appears 
spamassassin is working MUCH, MUCH better. For example, compare the original: 
(http://i.imgur.com/CRzX9Mu.jpg) to the SPAM I've received today: 
(http://i.imgur.com/wjUvfLj.jpg). It's catching pretty much 100% of SPAM, and 
so far, no false-positives. Thanks to the helpful members of this list!

 -Nick 

-Original Message-
From: Nick [mailto:n...@aryfi.com] 
Sent: Friday, October 03, 2014 3:48 PM
To: users@spamassassin.apache.org
Subject: RE: spamassassin working very poorly

Thanks guys, I just trained in 2089 legitimate ham messages, so hopefully that 
will do the trick. And also thanks to you John, as I didn't even see that 
URIBL_BLOCKED. I've setup a local recursion DNS server, which seems to have 
taken care of it.  Crossing my fingers that this has a positive impact on 
things. I'll update after some time has gone by.

 - Nick

-Original Message-
From: Reindl Harald [mailto:h.rei...@thelounge.net] 
Sent: Friday, October 03, 2014 3:17 PM
To: users@spamassassin.apache.org
Subject: Re: spamassassin working very poorly


Am 03.10.2014 um 21:07 schrieb Nick:
 Over the last few months, spamassassin has begun barely working for me

spammers also learn

 SPAM is so bad that I've actually started training it - which is 
 something I've never had to do in the past. So I've collected 370+ 
 e-mails over the last few days, and had sa-learn regularly read in 
 these messages Training it doesn't seem to have made any impact.

if you only train spam samples nothing will happen

you need *at least* 200 ham samples to start bayes get used and you really 
really don't want it any other way because it would kill all your legit mail - 
the filter needs to know differences and not every single word appeared in the 
spam-only samples to give a spam score

you need to careful floow this:
https://wiki.apache.org/spamassassin/BayesInSpamAssassin

 X-Spam-Status: No, score=1.1 required=5.0 
 tests=HTML_FONT_LOW_CONTRAST, 
 HTML_MESSAGE,MIME_HTML_ONLY,SPF_PASS,T_REMOTE_IMAGE,T_RP_MATCHES_RCVD,
 URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0

there is no BAYES tag and so it is not used



Training Bayes On A Gateway

2014-10-09 Thread John Traweek CCNA, Sec+
I've built a gateway server using sa-exim to filter email for our
corporate Microsoft Exchange environment.  It's working pretty good, but
I have Bayes turned off due to the fact that I am unsure on how to train
it in this type of environment.  Has someone written a how to article on
how to efficiently continually train Bayes in any environment like this.
I was thinking if specific users could forward SPAM to some box on
Exchange and have sa-exim POP it or something to learn that would be
ideal, but maybe there is a better way.  Any ideas are appreciated, the
easier the better.  TIA...

 






John Traweek CCNA, Sec+
Executive Director, Information Technology
Proud PCI Associate for 18 years
PCI: the data company




Heritage Square . 4835 LBJ Freeway, Suite 1100 . Dallas, TX  75244 . 
214.530.0394

Did you know last year, PCI raised over 9 million dollars in donations for our 
clients? Ask us how!

This Email is covered by the Electronic Communications Privacy Act, 18 U.S.C. 
Sections 2510-2521 and is legally privileged. The information contained in this 
Email is intended only for . If the reader of this message is not the intended 
recipient, you are hereby notified that any dissemination, distributions or 
copying of this communication is strictly prohibited. If you have received this 
communication in error, please notify us by telephone 1.800.395.4724 X160, and 
destroy the original message.

Re: Training Bayes On A Gateway

2014-10-09 Thread Reindl Harald


Am 09.10.2014 um 21:43 schrieb John Traweek CCNA, Sec+:

I’ve built a gateway server using sa-exim to filter email for our
corporate Microsoft Exchange environment.  It’s working pretty good, but
I have Bayes turned off due to the fact that I am unsure on how to train
it in this type of environment.  Has someone written a how to article on
how to efficiently continually train Bayes in any environment like
this.  I was thinking if specific users could forward SPAM to some box
on Exchange and have sa-exim POP it or something to “learn” that would
be ideal, but maybe there is a better way.  Any ideas are appreciated,
the easier the better


i just decided to stay on spamass-milter which implies a single user and 
so one central bayes trained with a simple script from two folders (ham 
and spam) and disable any autolearning - users are adviced to foreard 
samples as attachment which get added after review, until now not more 
than 5 per day, the rest is catched by the fact that i receive currently 
10 email addresses including some alias-lists and so face all sort of crap


the ham folder just contains a lot of my legit mail in case it don#t 
contain sensible data


the machine itself is inbound only with postfix-transport tables after 
the filters and so should match your subject


so far the results are impressive

the first script is a wrapper running as root and take care of 
permissions and remove dulicates to optimize the training in case of a 
complete rebuild, the sample eml-files are renamend with Konqueror to 
-mm-dd-# and so get a automatic number wich offers to remove 
outdated spam samples and rebuild easy in a year or two


the second script does the training itself, is running as the 
milter-user and is called with su from the wrapper, the milter-user 
has /bin/dash as sehll instead /sbin/nologin


[root@mail-gw:~]$ cat /scripts/sa-learn.sh
#!/usr/bin/bash
# Home-Directory und Name des Milter-Users
SA_MILTER_HOME=/var/lib/spamass-milter
SA_MILTER_USER=sa-milt
# Permissions der Lern-Dateien sicherstellen
chown root:$SA_MILTER_USER -R $SA_MILTER_HOME/training/ham/
chown root:$SA_MILTER_USER -R $SA_MILTER_HOME/training/spam/
chmod 750 $SA_MILTER_HOME/training/ham/
chmod 750 $SA_MILTER_HOME/training/spam/
chmod 640 $SA_MILTER_HOME/training/ham/*.eml
chmod 640 $SA_MILTER_HOME/training/spam/*.eml
# Duplikate in beiden Ordnern entfernen
/usr/bin/fdupes -r -f $SA_MILTER_HOME/training/ham/ | grep -v '^$' | 
xargs rm -v 2 /dev/null
/usr/bin/fdupes -r -f $SA_MILTER_HOME/training/spam/ | grep -v '^$' | 
xargs rm -v 2 /dev/null

# Worker-Script als Milter-User ausfuehren
/usr/bin/su -c $SA_MILTER_HOME/training/learn.sh $1 $SA_MILTER_USER

[root@mail-gw:~]$ cat /var/lib/spamass-milter/training/learn.sh
#!/usr/bin/bash
SA_MILTER_HOME=/var/lib/spamass-milter
SA_MILTER_USER=sa-milt
if test `whoami` = $SA_MILTER_USER
then
 /bin/echo   /dev/null
else
 /bin/echo Das Script 'learn.sh' muss als Benutzer '$SA_MILTER_USER' 
aufgerufen werden

 exit
fi
cd $SA_MILTER_HOME
SHOW_HELP=0
if [ $1 == rebuild ] || [ $1 ==  ] || [ `echo $((($1*2)/2))` == 
$1 ]; then

 # Kompletter Rebuild angefordert
 if [ $1 == rebuild ]; then
  # Bayes-Reset
  /usr/bin/sa-learn --clear
  # SPAM-Training
  MY_TIME=$(/usr/bin/date +%d-%m-%Y %H:%M:%S)
  echo $MY_TIME: Verarbeite SPAM Samples
  nice -n 19 /usr/bin/sa-learn --progress --spam 
$SA_MILTER_HOME/training/spam/*.eml

  echo 
  # HAM-Training
  MY_TIME=$(/usr/bin/date +%d-%m-%Y %H:%M:%S)
  echo $MY_TIME: Verarbeite HAM Samples
  nice -n 19 /usr/bin/sa-learn --progress --ham 
$SA_MILTER_HOME/training/ham/*.eml

  echo 
 else
  # Default auf aktuellen Tag oder Parameter
  if [ $1 ==  ]; then
   TRAIN_DAYS=1
  else
   TRAIN_DAYS=$1
  fi
  # HAM-Training
  MY_TIME=$(/usr/bin/date +%d-%m-%Y %H:%M:%S)
  echo $MY_TIME: Verarbeite SPAM Samples
  nice -n 19 /usr/bin/find $SA_MILTER_HOME/training/spam/ -type f -name 
\*.eml -mtime -$TRAIN_DAYS | xargs -r /usr/bin/sa-learn --spam

  echo 
  # HAM-Training
  MY_TIME=$(/usr/bin/date +%d-%m-%Y %H:%M:%S)
  echo $MY_TIME: Verarbeite HAM Samples
  nice -n 19 /usr/bin/find $SA_MILTER_HOME/training/ham/ -type f -name 
\*.eml -mtime -$TRAIN_DAYS | xargs -r /usr/bin/sa-learn --ham

  echo 
 fi
else
 SHOW_HELP=1
fi
if [ $1 == --help ] || [ $1 == -h ] || [ $SHOW_HELP == 1 ]; then
 echo Bayes-Maintaining-Skript
 echo Usage:
 echo   rebuild: Bayes komplett zuruecksetzen und anhand der Samples 
neu aufbauen

 echo   days:  Alter der zu trainierenden Samples in Tagen (Default: 1)
 exit
fi
MY_TIME=$(/usr/bin/date +%d-%m-%Y %H:%M:%S)
echo $MY_TIME: Done
echo 
nice -n 19 /usr/bin/sa-learn --dump magic
echo 
/usr/bin/ls -l -h --time-style=long-is $SA_MILTER_HOME/.spamassassin/



signature.asc
Description: OpenPGP digital signature


Re: Training Bayes On A Gateway

2014-10-09 Thread John Hardin

On Thu, 9 Oct 2014, John Traweek CCNA, Sec+ wrote:


I've built a gateway server using sa-exim to filter email for our
corporate Microsoft Exchange environment.  It's working pretty good, but
I have Bayes turned off due to the fact that I am unsure on how to train
it in this type of environment.  Has someone written a how to article on
how to efficiently continually train Bayes in any environment like this.
I was thinking if specific users could forward SPAM to some box on
Exchange and have sa-exim POP it or something to learn that would be
ideal, but maybe there is a better way.  Any ideas are appreciated, the
easier the better.  TIA...


This topic comes up fairly regularly. Did you search the list archives on 
terms like exchange bayes ?


There's no explicit coverage of this in the wiki, but these pages may 
help:


http://wiki.apache.org/spamassassin/SiteWideBayesFeedback

http://wiki.apache.org/spamassassin/RemoteImapFolder

...though I've heard Exchange has deprecated public IMAP folders.

--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  The reason it took so long to get Bin Laden is that it took the
  SEALs five years to swim that far into the desert.  -- anon
---
 861 days since the first successful private support mission to ISS (SpaceX)


Re: Training Bayes On A Gateway

2014-10-09 Thread Jason W.
On Thu, Oct 9, 2014 at 4:14 PM, John Hardin jhar...@impsec.org wrote:

 On Thu, 9 Oct 2014, John Traweek CCNA, Sec+ wrote:

  I've built a gateway server using sa-exim to filter email for our



 This topic comes up fairly regularly. Did you search the list archives on
 terms like exchange bayes ?


Since the OP mentioned exim, I'll share a bit of how I did something
similar. While I have Exchange in the picture, most of my users are not on
it.

I wanted to be able to fully reject mail at SMTP time if SpamAssassin (SA
does not block mail g) and not worry about whether exim would change the
log format if I did a 'fakereject'. SMTP rejects are nice since I do not
quarantine spam. I didn't see elsewhere, either on the SA wiki or
elsewhere, so figured I'd share and maybe help out somewhere..

I use exim's native SA integration, not sa-exim. I also use dovecot for my
IMAP users' mailboxes, and this is where my spam mail goes.

In my data ACL within exim.conf, I have:

---

  # Call SA and add some headers to the email delivered via normal means if
it's non-spam
  warnspam  = spam:true/defer_ok
  add_header= X-Spam-Score: $spam_score ($spam_bar)
  add_header= X-Spam-Report: $spam_report

  # If it's spam (defined as an SA score  5), then run my custom deliver
script against the copy of the email in the exim mail spool.
 # Exim's mail spool copy won't have the above added headers, so need to do
so here to see them in the spam mailbox.
  warncondition = ${if {$spam_score_int}{50}{1}{0}}
  condition = ${run{/home/spam/bin/deliver incoming-spam
$spool_directory/scan/$message_id/$message_id.eml 'X-Spam-Score:
$spam_score\nX-Spam-Report: $spam_report'}}

  denycondition = ${if {$spam_score_int}{50}{1}{0}}
  message   = .

-

/home/spam/bin/deliver contains:



#!/bin/bash

MAILBOX=$1
FILE=$2
shift
shift
HEADERS=$*

TMPFILE=/tmp/deliver.$$

echo -e $HEADERS  $TMPFILE
# Exim writes out a standard mbox-style From line, remove it
cat $FILE | tail -n +2  $TMPFILE

# Dovecot must be root to do direct delievery
cat $TMPFILE | sudo /usr/libexec/dovecot/deliver -d spam -m $MAILBOX

rm $TMPFILE

-- 
HTH, YMMV, HANW :)

Jason

The path to enlightenment is /usr/bin/enlightenment.


Re: spamd does not start

2014-10-09 Thread LuKreme

 On 08 Oct 2014, at 16:23 , Duane Hill duih...@gmail.com wrote:
 
 On Wednesday, October 8, 2014, 3:11:06 PM, LuKreme wrote:
 
 On 08 Oct 2014, at 04:56 , Duane Hill duih...@gmail.com wrote:
 
 On Tuesday, October 7, 2014, 10:56:54 PM, LuKreme wrote:
 
 On 07 Oct 2014, at 11:45 , Jari Fredrisson ja...@iki.fi wrote:
 I ran sa-update  sa-compile.
 
 Should sa-compile be run after sa-update?
 
 I have a crontab entry:
 
 16  1  *  *  *  /usr/local/bin/sa-update 
 /usr/local/etc/rc.d/sa-spamd restart
 
 should I add an sa-compile call?
 
 I am on FreeBSD here. This is what I use:
 
 Content of sa_update.sh:
 
 #!/bin/sh
 
 /usr/local/bin/sa-update -D --nogpg
 
 if [ $? -eq 0 ] ; then
 /usr/local/bin/sa-compile
 /usr/local/etc/rc.d/sa-spamd restart
 exit 0
 else
 exit 0
 fi
 
 This  way, sa-compile is ran and spamd is restarted only when there is
 an update. I then use the script in a cron which runs once per day.
 
 I  believe  the  way  you have it, spamd will get restarted every time
 your cron is ran whether there is an update or not.
 
 It will get restarted if the sa-update process finishes cleanly
 (that’s what  does) which I think is the same as if [ $? -eq 0];
 
 So, I’ll add an sa-compile in there, thanks.
 
 No.is  a  way  of chaining commands together. Your cron says run
 sa-update  and  then  restart  spamd.  In  other words, when sa-update
 finishes  running,  regardless  if there was an update applied or not,
 restart spamd.

No, that is not what it says.

$ man 1 bash
…
The  control  operators   and || denote AND lists and OR lists, respectively. 
 An AND list has the form

  command1  command2

command2 is executed if, and only if, command1 returns an exit status of zero.


-- 
What if there were no hypothetical questions?



Re: spamd does not start

2014-10-09 Thread LuKreme
On 09 Oct 2014, at 18:35 , LuKreme krem...@kreme.com wrote:
 No, that is not what it says.
 
 $ man 1 bash
 …
 The  control  operators   and || denote AND lists and OR lists, 
 respectively.  An AND list has the form

Sorry for duplicating other’s posts, I replied to the original message out of 
the “replies to me” folder without checking the overall list folder.

-- 
'The gods,' he said. 'Imprisoned in a thought. And perhaps they were
never more than a dream.' --Sourcery



Re: Training Bayes On A Gateway

2014-10-09 Thread Ted Mittelstaedt


I collect spam this way, periodically I scan the mail logs looking for 
unknown user entries and sort the results - usernames/email addresses 
that are repeatedly being guessed get an alias entry added that 
forwards the spam to a spam mailbox.  I have about 20 of these now that

are aliased to the spambox and that box gets tons and tons of spam.

Ham is just my own email folders - all legitimate mail I get, once I
finish dealing with it, goes into an archive, and that archive is
periodically fed into the Bays learner.

Ted

On 10/9/2014 12:43 PM, John Traweek CCNA, Sec+ wrote:

I’ve built a gateway server using sa-exim to filter email for our
corporate Microsoft Exchange environment. It’s working pretty good, but
I have Bayes turned off due to the fact that I am unsure on how to train
it in this type of environment. Has someone written a how to article on
how to efficiently continually train Bayes in any environment like this.
I was thinking if specific users could forward SPAM to some box on
Exchange and have sa-exim POP it or something to “learn” that would be
ideal, but maybe there is a better way. Any ideas are appreciated, the
easier the better. TIA…



*John Traweek CCNA, Sec+
*Executive Director, Information Technology
Proud PCI Associate for 18 years
T: 214.530.0394


*Did you know last year, PCI raised over 9 million dollars in donations
for our clients? Ask us how!*



*
*

This Email is covered by the Electronic Communications Privacy Act, 18
U.S.C. Sections 2510-2521 and is legally privileged. The information
contained in this Email is only for the intended recipient. If the
reader of this message is not the intended recipient, you are hereby
notified that any dissemination, distributions or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify us by telephone 1.800.395.4724
X160, and destroy the original message.